Telehealth solved a real problem: it let practices meet clients where they are. But most virtual-care setups were assembled in a hurry, and the seams show. A scheduling tool here, a video vendor there, a payment processor, a forms app, an email service — each one a separate company, each one holding its own copy of something sensitive about your clients. The convenience was real. So was the quiet cost: you no longer know, with confidence, where your patients’ data lives or who can reach it.
Every integration is another party who holds a copy
When a booking runs through one vendor, the consultation through another, and billing through a third, a single client’s information fans out across a chain of companies you don’t control. Under the GDPR, health data is a “special category” (Article 9) — it carries a higher bar for lawful processing and protection than ordinary personal data (source: the text of the GDPR). That bar doesn’t stop at your own database. It follows the data everywhere it goes, which means every third-party tool in the chain is part of your compliance surface, not a way to shrink it.
There is a jurisdictional wrinkle that surprises many operators, too. Under the US CLOUD Act, US-owned cloud providers can be compelled to disclose data even when the servers physically sit inside the EU. Roughly three US firms hold about 65% of the European cloud market (sources: European DIGITAL SME Alliance, n-ix). The practical lesson is uncomfortable but clarifying: where your client data physically lives is not the same question as who can legally reach it.
Privacy as an architecture decision, not a policy line
Most privacy work happens at the level of policy — consent forms, data-processing agreements, checkboxes. Those matter, but they sit on top of an architecture that may quietly contradict them. The more durable move is to change the architecture so that fewer parties ever touch the data in the first place. If your consultations, your booking, and your payments all run on infrastructure you govern, the number of outside companies holding a copy of anything sensitive drops toward zero. Privacy stops being a promise you police across a dozen vendors and becomes a property of how the system is built.
This is the logic behind self-hosted platforms. VBWD, for instance, is a full-stack, self-hosted SDK: one Python backend core with a Vue/TypeScript web front end plus native iOS and Android SDKs, all served from that single backend — so a practice can reach clients on web, iPhone and Android without maintaining three separate builds. Its core is intentionally agnostic, with capabilities added as plugins — booking and scheduling, payments, subscriptions, catalogue, content, chat — each toggling on or off without a restart. Self-hosted, in this framing, means something concrete: the client data, the customer relationship and the billing are yours, inside your own jurisdiction, rather than a tenancy on infrastructure you don’t govern. You can read more about that sovereign-by-default posture in VBWD’s write-up on commerce built for the NIS2 era.
Why the timing matters
The regulatory floor is rising. The NIS2 Directive reached full effect across the EU in 2026, bringing audits and 24-hour incident reporting, fines up to EUR 10M or 2% of turnover, and — notably — the prospect of personal liability for management. Germany’s BSI issued an early EUR 850,000 fine for weak incident detection (sources: Reed Smith, Freshfields). Meanwhile, the cost of getting it wrong keeps climbing: the IBM Cost of a Data Breach 2026 report puts the global average breach at $4.99M and the US average at $11.5M, with healthcare consistently among the most expensive sectors (source: Help Net Security). The fewer places sensitive data lives, the smaller every one of those numbers becomes for you.
The honest caveat
Owning your infrastructure is not free of trade-offs, and pretending otherwise would be dishonest. A self-hosted platform like VBWD is younger and less “mature” than twenty-year-old telehealth incumbents; it trades some accumulated edge-case polish for modern architecture, speed, auditability and data sovereignty. For a practice that treats privacy as a structural commitment, that’s often the better trade. For a team that needs a heavily certified turnkey suite and has no appetite to run anything themselves, it may not be. The right answer depends on your risk posture, your regulatory exposure and how much you value controlling the whole chain. Say the trade-off out loud before you choose — that’s the point.
If your practice is wrestling with any of this — a telehealth stack stitched from tools that each hold a copy of your clients’ data, or a growing unease about who can actually reach those records — the useful next step is concrete: see it running for your own business. Request an enterprise installation and bring the numbers you want to improve.
Sources: text of the GDPR (Article 9); Reed Smith and Freshfields (NIS2); Help Net Security (IBM Cost of a Data Breach 2026); European DIGITAL SME Alliance and n-ix (US CLOUD Act and EU cloud market concentration).
